As a technology of managing a computer system, there is known a technology of analyzing, on the basis of a sign of a failure or a plurality of failures detected in a system, a cause of the failure, etc. For example, a failure analysis system disclosed in PTL 1 uses management software to accumulate data relating to an event such as a failure occurring in a management target apparatus or in a component included in the management target apparatus, into an event DB (database). Moreover, such a failure analysis system has an analysis engine for analyzing a cause and effect relationship of a plurality of events occurring in a management target apparatus, etc. The analysis engine accesses a configuration management DB in which configuration information of a management target apparatus, etc., is stored, and recognizes, as a single group called “topology”, a relationship among a plurality of management target apparatuses existing on a certain I/O (input/output) path. Then, when an event occurs, the analysis engine applies a previously determined meta-rule including an IF section and a THEN section to the topology that includes the management target apparatus, etc., which is related to the occurring event, and builds an expanded rule for analyzing the cause of a failure. The expanded rule is information indicating a relationship between a cause event that may be a root cause and one or more influence events brought about when the cause event occurs. Specifically, the cause event is described in the THEN section of a rule, and the influence event is described in the IF section of a rule.